Integration of network admission control functions in network access devices

• US 20120216239A1
• Filed: 02/23/2011
• Published: 08/23/2012
• Est. Priority Date: 02/23/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Yadav, Navindra, Joseph, Aji, Kumar, Shashi, Mahamuni, Atul, Ozakil, Azim, Akyol, Bora A., Feng, Peirong, Enderwick, Thomas J., Valliappan, Sambasivam
• Granted Patent: US 9,071,611 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

In one embodiment, a method includes receiving a communication from an endpoint device at a network access device located within a data path between the endpoint device and a network, identifying a network admission control policy for the endpoint device, enforcing at the network access device, the network admission control policy for traffic received from the endpoint device, and forwarding at the network access device, traffic from the endpoint device to the network in accordance with the network admission control policy. An apparatus is also disclosed.

Claims

1. A method comprising:

receiving a communication from an endpoint device at a network access device located within a data path between the endpoint device and a network;

identifying a network admission control policy for the endpoint device;

enforcing at the network access device, said network admission control policy for traffic received from the endpoint device; and

forwarding at the network access device, traffic from the endpoint device to the network, in accordance with said network admission control policy.

2. The method of claim 1 wherein identifying said network admission control policy comprises receiving policy information from a network admission control manager in communication with the network access device and other network access devices.

3. The method of claim 1 further comprising performing profiling operations at the network access device to identify the endpoint device, wherein said network admission control policy is based on identification of the endpoint device.

4. The method of claim 1 wherein identifying said network admission control policy further comprises attempting to authenticate the endpoint device.

5. The method of claim 1 wherein identifying said network admission control policy further comprises receiving a service template from a network admission control manager.

6. The method of claim 1 wherein identifying said network admission control policy further comprises assessing a status of the endpoint device.

7. The method of claim 1 wherein enforcing said network admission control policy is performed in hardware at the network access device.

8. The method of claim 1 wherein the network access device is an access layer switch.

9. An apparatus comprising:

a forwarding engine for receiving traffic from an endpoint device and forwarding the traffic to a network; and

a network admission control server for identifying a network admission control policy for the endpoint device and enforcing said network admission control policy for traffic received from the endpoint device;

wherein the apparatus is configured for operation within a data path between the endpoint device and the network.

10. The apparatus of claim 9 wherein enforcing said network admission control policy is performed in hardware.

11. The apparatus of claim 9 further comprising a profiler for performing profiling operations at the network access device to identify the endpoint device, wherein said network admission control policy is based on identification of the endpoint device.

12. The apparatus of claim 9 wherein the network admission control server is operable to communicate with a network admission control manager for authentication of the endpoint device.

13. The apparatus of claim 9 wherein the network admission control server is operable to communicate with an agent installed at the endpoint device to assess a status of the endpoint device.

14. An apparatus comprising:

a forwarding engine for receiving traffic from an endpoint device and forwarding the traffic to a network; and

a profiler for identifying an endpoint device in communication with the apparatus and providing identification information for each of the endpoint devices in communication with the apparatus to a manager;

wherein the apparatus is configured for operation within a data path between the endpoint device and the network.

15. The apparatus of claim 14 wherein identification of the endpoint device is performed in hardware.

16. The apparatus of claim 14 further comprising a network admission control server for enforcing a network admission control policy for each of the endpoint devices in communication with the apparatus, said network admission control policy based on said identification information.

17. The apparatus of claim 14 wherein the profiler is operable to update said identification information based on data received from the endpoint device.

18. The apparatus of claim 14 wherein the apparatus is configured to perform deep packet inspection for use in identifying a type of endpoint device.

19. The apparatus of claim 14 wherein the profiler is operable to continuously review traffic transmitted to the network access device from the endpoint device.

20. The apparatus of claim 14 wherein the profiler is configured to inspect all traffic transmitted from the endpoint device to the network.